0

There's one software, let's call it an anti-malware, that uses a heuristic to detect some types of attack. However there's a very simple to stay under its radar. Where may I report that kind of "exploit"? It does not require patching anything at runtime or any interaction with that software, so I don't see it really as a vulnerability, just something they've overlooked. Where would I report that? Does that qualify for CVE?

4
  • You have not described a vulnerability or an exploit. You've described a weakness in the operation. Every single anti-malware detection process will have weaknesses. These do not qualify for CVEs.
    – schroeder
    Sep 13, 2019 at 6:40
  • @schroeder : thanks, you have confirmed my feeling and answered 50% of my question. I'm not even sure there's any common place to report weaknesses. Could you answer, including whether you're aware of such place? Sep 13, 2019 at 6:47
  • The only people to report it to is the developer.
    – schroeder
    Sep 13, 2019 at 6:59
  • That's been done a while ago... If you make your comment an answer I'll accept it. Sep 13, 2019 at 7:33

1 Answer 1

0

You have not described a vulnerability or an exploit. You've described a weakness in the operation. Every single anti-malware detection process will have weaknesses. These do not qualify for CVEs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .